What is shadow IT and why is it a risk?

Shadow IT is one of the largest blind spots in enterprise software management. The term refers to all technology, software, apps, cloud storage, and communication tools that employees use without explicit approval from IT or procurement. And it is growing faster than most organisations realise.

How does shadow IT arise?

Shadow IT almost always arises from a genuine problem. An employee needs a tool to do their job, the approval process takes too long, or the alternative offered by IT is inconvenient. The quickest solution is to create a free account or put a small subscription on the company credit card.

What starts as one person using one tool quickly grows. Colleagues join in, files are shared via unauthorised platforms, and sensitive company data ends up on servers outside the EU, often without anyone noticing.

Why is shadow IT a problem?

Shadow IT has three concrete consequences:

1. Security risks. Unapproved tools are not screened for security, not updated, and not monitored. They represent an open door for data breaches and cyber attacks.

2. Compliance risks. Data processed via unapproved tools falls outside the organisation’s GDPR oversight. In the event of a data breach, the organisation remains liable.

3. Waste. Organisations pay for centralised tools while employees use free or cheap alternatives alongside them. Consolidation is impossible without clear oversight.

Shadow IT and NIS2

With the introduction of NIS2, shadow IT becomes an even greater risk. The duty of care requires organisations to maintain an up-to-date overview of all software and suppliers, including tools purchased outside formal procurement processes. Shadow IT by definition makes this overview incomplete.

How do you tackle shadow IT?

The approach does not start with banning but with understanding. Why do employees use certain tools? What is missing from the approved offering? Only when you answer these questions can you consolidate effectively and improve the formal software offering.

Practical steps: analyse credit card statements and invoices for unknown software subscriptions, conduct an employee survey on tools used, and relay findings back to IT and procurement for a consolidated approach.